Greeklish-permalink <= 3.3 - Unauthenticated Post Slug Update

2023-06-1900:00:00

Jonas Höbenreich

unauthenticated

update

post slug

greek characters

latin characters

exploit

EPSS

0.001

Percentile

34.4%

JSON

The plugin does not implement correct authorization or nonce checks in the cyrtrans_ajax_old AJAX action, allowing unauthenticated and low-privilege users to trigger the plugin’s functionality to change Post slugs either directly or through CSRF.

1. Create a post with the name "Νέα ανάρτηση".

2. Visit the post and notice that the permalink uses the Greek characters.

3. In an unauthenticated browser session, run the following code: fetch('/wp-admin/admin-ajax.php?action=cyrtrans_ajax_old', {method: 'POST'})

4. Visit the post again, and notice that the permalink now uses Latin characters.

EPSS

0.001

Percentile

34.4%

JSON

Related for WPEX-ID:45878983-7E9B-49C2-8F99-4C28AAB24F09